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Extensions to finite-state automata on strings, such as multi-head automata or multi-counter au¬ 
tomata, have been successfully used to encode many infinite-state non-regular verification prob¬ 
lems. In this paper, we consider a generalization of automata-theoretic infinite-state verification 
from strings to labeled series-parallel graphs. We define a model of non-deterministic, 2-way, con¬ 
current automata working on series-parallel graphs and communicating through shared registers on 
the nodes of the graph. We consider the following verification problem: given a family of series- 
parallel graphs described by a context-free graph transformation system (GTS), and a concurrent 
automaton over series-parallel graphs, is some graph generated by the GTS accepted by the automa¬ 
ton? The general problem is undecidable already for (one-way) multi-head automata over strings. We 
show that a bounded version, where the automata make a fixed number of reversals along the graph 
and use a fixed number of shared registers is decidable, even though there is no bound on the sizes of 
series-parallel graphs generated by the GTS. Our decidability result is based on establishing that the 
number of context switches is bounded and on an encoding of the computation of bounded concurrent 
automata to reduce the emptiness problem to the emptiness problem for pushdown automata. 


1 Introduction 

The language-theoretic approach to verification models the behaviors of a system as a set —or a lan¬ 
guage — of structures (such as strings or trees), and defines machine models that generate or accept 
these languages. The verification problem reduces to the language-emptiness problem for these models. 
The simplest such models are finite-state machines over finite or infinite words or trees, and this forms the 
basis of the hugely successful automata-theoretic approach to (finite-state) model checking 1201 . Finite 
state machines have been generalized in many ways to extend the set of languages that may be needed 
to model more complex (non-regular) computational processes. For example, they can be extended with 
data structures such as stacks or counters, or with multiple heads or tapes and allowing 2-way traversals 
of the input ifl^fTTll . 

Since the emptiness problem can be undecidable for many extensions, research in infinite-state ver¬ 
ification has focused on finding suitable underapproximations for which language emptiness is algorith¬ 
mically decidable. For example, the reversal boundedness restriction bounds the number of reversals 
of the counters or of stacks, or the number of traversals of the input ifT^ [141 fTTl [TOl and the bounded 
language restriction considers behaviors describable by abounded language |l9j[8l. Overall, the approach 
has led to beautiful theoretical results and has also been quite successful in modeling many infinite-state 
parameterized computational models and reasoning about them algorithmically. 

Most previous work in parameterized verification has focused on machine models for string or tree 
languages. In this paper, we study behaviors encoded as series-parallel graphs whose edges are labeled 
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with a finite alphabet. Series-parallel graphs generalize strings or multi-tape machines by allowing mul¬ 
tiple parallel “tracks” to fork off and rejoin at any point. They allow modeling various natural modes of 
computation, e.g., fork-join parallelism in data-parallel programs, while retaining enough structure, e.g., 
having a natural “forward” direction, that is absent in general graphs. Languages over series-parallel 
graphs can be naturally described using context-free graph transformation systems (GTSs), which de¬ 
scribe the dynamic evolution of families of graphs through local rewrite rules |l5]|2j|3|. 

We define and study a class of concurrent finite-state automata traversing series-parallel graphs and 
communicating through state-holding registers located at the nodes of the graph. More precisely, in our 
model of computation, a fixed number of finite-state machines traverse the nodes of a series-parallel 
graph. At each step, one of the machines makes a transition that depends on the current state of the 
machine, the label it reads on one of the incoming or outgoing arcs, and the value of the register stored at 
its node. The machine moves along the selected edge, updating its state as well as the register. Machines 
are thus 2-way and non-deterministic, and communicate through the shared registers. A series-parallel 
graph is accepted if some subset of machines reaches some final states being at the same node of the 
graph. 

We study the emptiness problem: given a context-free GTS defining a language of series-parallel 
graphs, and a concurrent finite-state automaton, check if there is a graph in the language of the GTS 
accepted by the automaton. This problem is, not surprisingly, undecidable: for example, we can encode 
linear bounded automata over strings. We study a natural restriction of the emptiness problem by re¬ 
stricting the number of reversals along the computation and by putting a bound on the number of shared 
registers in the graph. With these two restrictions, we show that the emptiness problem is decidable and 
can be reduced to the emptiness problem for pushdown automata. Note that even with the restrictions, 
the problem is infinite-state because there is no a priori bound on the size of the series-parallel graphs 
generated by the GTS. 

The reduction is based on two technical observations. First, when the number of reversals and the 
number of registers are fixed, there is a bound on the number of parallel tracks in the graph that needs to 
be tracked. We also establish a bound on the number of different times each machine moves along the 
run (although the length of the run may be unbounded). Second, using the bounds above, we construct a 
large alphabet that tracks valid runs of the machines on a valid graph generated by the GTS. We do this 
in several steps. We construct a pushdown automaton that checks that a word is a valid representation 
of a subgraph of a graph generated by the context-free GTS. We construct a set of automata, one for 
each machine, that checks that the word encodes a correct run of that machine along the graph. Finally, 
we construct another automaton that checks that the run is accepted by the concurrent automaton. Some 
graph generated by the GTS is accepted if the intersection of all these automata is non-empty. 


Other Related Work The automata-theoretic approach is often called regular model checking, when 
applied to parameterized verification lUl. An extensive study of the decidability of several verification 
problems for classes of GTSs was carried out in |4|. The problems considered there are reachability of a 
given graph, coverability (reachability of a graph that contains a given graph as a subgraph) and existen¬ 
tial coverability, which asks whether there exists an initial graph such that the answer to the coverability 
problem is positive. The classes of GTSs they investigate are defined by structural restrictions on the set 
of transformation rules. Classes with decidable coverability problem are context-free graph grammars, 
well-structured GTSs and the ones that keep the number of nodes constant. Hyperedge-replacement 
graph grammars @ and vertex-replacement graph grammars Q are well-studied classes of GTSs. It 
is known that for such graph grammars satisfiability of Monadic Second Order (MSO) formulas is de- 
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cidable A logic for expressing properties that involve interleaving of temporal and graph modalities 
was developed in El as a comhination of MSO and the /i-calculus. They employ an approximation 
of GTS [2] that preserves fragments of the logic to obtain a sound but incomplete verification method 
for these fragments. A method to refine such approximafions based on counferexamples was developed 
in ifTSll . ifTSl describes a fool for model checking finife-sfafe graph fransifion sysfems againsf firsl order 
temporal logic properfies. The work |[T^ sfudies fhe empfiness problem for concurrenf aufomafa wifh 
auxiliary storage and provides a generalization of fhe decidabilify resulfs for a number of classes of such 
aufomafa for which fhe empfiness problem can be reduced to emptiness of finife-sfafe graph aufomafa 
defined MSO definable graphs wifh bounded free widfh. If mighf be possible fo obfain or generalize fhe 
resulfs we esfablish in fhis paper fhrough argumenfs similar to fheirs. 


2 Graph-grammar Transition Systems 

Lef A be a finile sef. As usual, fhe sef A* consisfs of all finite sequences of elemenfs of A. Lef 7t = 
uqUi .. € A*. We define = a„a„^\ .. .a\aQ and last(7r) = a„. The lengfh |7r| = n + 1 of tt is 

fhe number of elemenfs of Tt and given 0 < i < j <n we denote 7t\i] = a,- and 7t[i, j] = a,-... a/. 

Wifh M(A) = {S I S : A —)• N} we denote fhe sef of mulfisefs over A. For S\,S 2 € M(A) we define 
Si A S 2 iff for every a € A we have Si (a) < S 2 (a). We use square brackefs fo denote mulfisefs, for 
example, [ai,a 2 ,a 2 ] denotes S G M(A), where S(ai) = 1, S(a 2 ) =2 and S{a) =0 for all a € A \ {ai,a 2 }- 

2.1 Series-parallel graph grammars 

Fix an alphabef £. We consider graphs labeled wifh letters from £. A graph is a fuple G = {N,E,nh,ne) 
where A is a finite sef of nodes, E G M(A x A x Z) is a mulfisef of edges and G A are fwo distin¬ 
guished nodes called source and sink, respectively. For an edge e = {n,n', a) G E, we write src{e) for n 
and trg{e) for n', and a{e) for fhe label a of e. We wrife for fhe sef of all Z-labeled graphs. 

Lef G = {N,E,ni,,ne) and G' = {N',E 'be graphs on disjoinl sefs of nodes. For an edge 
c = (ni,n 2 ,a) G E, fhe edge replacement graph G[c 1 -^ G'] is fhe (unique up fo isomorphism) graph 
defined by removing one copy of fhe edge c from G, and adding fhe nodes and edges of G' by fusing 
ill wifh and n 2 wifh n^. Formally, G[E i-)- G'] = {N”,E'',ni,,ne), where A" = A U (A' \ 

E" = {E\ {c}) yjE', where fhere is an edge {n\,n 2 ,o) in fhe mulfisef E' wifh some mulfiplicify iff 

• in E', wifh fhe same mulfiplicify, fhere is an edge a), and ny = srcie) and n 2 = trg{e), or 

• in E', wifh fhe same mulfiplicify, fhere is an edge {ni,n2,(7), and n\^n'^ and n 2 ^n'g, or 

• in E', wifh fhe same mulfiplicify, fhere is an edge (n^,?i 2 , <7), and n\ = srci^), or 

• in £■', wifh fhe same mulfiplicify, fhere is an edge (n 1 , , a), and n 2 = trg (c). 

Definition 1 (Series-parallel graph grammar). A series parallel graph grammar (SPGG) is a tuple ^ = 
{V,'L,R,Gq), where V is a finite set of variables, £ is a finite alphabet (ZflF = 0), 7? C F x A^uv 
finite set of rules, Go = {{nb,ne},{{nb,ne,vo)},nb,ne) G withnb f^n^ is the initial graph. 

Eurthermore, each rule (v,G') G R, where G' = {N' ,E' ,n'^,n'fj, satisfies exactly one of the following: 

(1) N' = {n'f^,n'g}, E' = {(n^,?i^,a)} and a G £, denoted (v, a) G R; 

(2) N' = {n'ij,n'g,n'} has three nodes, E' = vi), (n',ng,V 2 )} and vi,V 2 G V, denoted by (v,vi • 

V 2 ) G 7? (series composition); 

(3) N' = {n'ij,n’g} has two nodes, E' = {{n'y,nfv\), V 2 )} and vi,V 2 G V, denoted by (v,vi || V 2 ) G 

R (parallel composition). 
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((c,.).0,0) 



(a) A series parallel graph with E = {a,b,c}. (b) A finite-state machine with E = {a,b,c}. 

Figure 1: A series parallel graph generated by an SPGG and a finite-state machine over the same alphabet. 


An SPGG derives a graph in as follows. It starts with the graph Go- In each step, it picks an 
arbitrary edge e of the current graph G that is labeled with a variable v G F, and applies a rule (v, G') G 
to get a new graph G” = G[e G']. In this case, we write G G". A graph G G Jifz is derived if there 
is a sequence Gq G\... G„ = G of steps that results in G. Note that every graph thus derived is 
a series-parallel graph labeled with £, so an SPGG represents a set of series-parallel graphs labeled with 
E. We write for the set of graphs in derived by 

Example 1. As an example of an SPGG consider = (F,r,7?,Go) with variables V = {vo,vi,Va,Vb,Vc}, 
set of terminal symbols E = {a,b,c}, initial graph Gq = ({«;,,«£}, cind rules 

R = {(vo,Vc-Vi),(vi,Va II Vb),{Va,a),{vb,b),{Vc,c),{Va,Va-Va),{vbAb-Vb)fvb,Vb || Vfo),}. 

Figure\T^shows a (series-parallel) graph G derived from the SPGG The directions of the edges 
denote the “natural” direction from source to sink associated with a series parallel graph. 

A series-parallel graph has a natural “direction” associated with it from the source to the sink, con¬ 
sistent with the direction n\ —> n 2 of an edge {ni,n2,(7). In particular, it has no directed cycles. For 
convenience, we introduce the “symmetric closure” of series-parallel graphs. For each edge {ni,n2,(7) 
labeled with a, we augment the label with a direction 1 to obtain (a, 1) (1 capturing the “forward” di¬ 
rection), and add an opposite edge {n 2 ,ni,{a,—l)) labeled with (a, —1) denoting the edge taken in the 
“backward” direction. Formally, given a series-parallel graph G = {N,E,nb,nf), we define ifs symmefric 
closure G' = {N,E',nb,ne) G =^x{i,-i}> where E' = {{n,n'\ {n,n',o) G E} U (a, —1)) | 

{n',n, a) € E}. We write for fhe sef of symmefric closures of all graphs derived by ^. 

Remark. While for simplicify of fhe presenfafion we consider graphs wifh a single pair of source and 
sink nodes, our resulfs can in principle be extended fo graphs wifh mulfiple such nodes. However, fhe 
aufomafa consfrucfion ouflined in Section 1431 relies on fhe sfrucfure of fhe rules of an SPGG and does 
nol direcfly generalize fo general confexf-free GTSs defining sefs of directed acyclic graphs. 

2.2 Graph-grammar transition systems 

We now define communicating finite aufomafa on fhe symmefric closure of series-parallel graphs. Recall 
fhaf fhese are series-parallel graphs whose edges are labeled wifh an alphabef and a direcfion. Infuifively, 
a sysfem of communicating machines has a sef of m machines fhaf fraverse fhe edges of a series-parallel 
graph, some of whose nodes are annofafed wifh Boolean regisfers. Each aufomafon fraverses fhe edges 
of fhe graph: when fhe aufomafon is af a node n of fhe graph and in sfafe q, if reads fhe register on fhe 
node, chooses an edge wifh source node n labeled wifh gEx{1, — 1} based on ifs currenf slate. 
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the label, and the value read from the register, traverses the edge and moves to the target node of that 
edge and to a new state q\ and writes a value to the register at the source node. 

Let r be a finite alphabet. A finite-state machine ^ 5) consists of finite set of states Q, 

initial state <7^ G Q, input alphabet £, and transition relation 5 C 2x (lx {1,-1}) xB X gxB. 

The intuitive meaning of a transition {q, {a,d),b,q',b') € 5 is that when the machine ^ is in state 
q and reads input letter a € £, direction { 1 ,- 1 }, and register value b, then it changes its state to q' and 
moves along an edge labeled (a,d) in the graph and writes b' to the register. 

Example 2. Figure\T^shows an example of a finite-state machine ^ 5) with states Q = 

input alphabet £ = {a,b,c} and transition relation 5 depicted in Figure\T^ where a label 
{{{(J,d),p,p') on an edge from state q to state q' stands for the transition {{q, {a,d),p,q' ,p'). 

A system of machines {^,m) is a set of m disjoint copies of the machine 

Definition 2 (Graph-grammar transition system). Let ^ be a finite-state machine. A 

system of m machines {.yfi(,m), together with an SPGG = (L,r,/?,Go) defines a transition system 
r(,^,m,f#) = (r,ro,—?•) as follows. The set of configurations F consists of all tuples {G,p,l5) such 
that G G is a graph derived by and: 

• p : N ^ 2^^’-’’”^^^ maps each node in G to the states of the machines at that node; we require 
that for each / G {1,..., mf there exists exactly one n^N and exactly one q GQ with (/, q) G p{n); 

• j 8 : A —B maps each node to the value of the Boolean register at that node. 

The set Fq of initial configurations is such that 7 = {G,p,l5) gTq iff y GT, p{nb) = {(f,<7°) | i G 
{1,... ,m}}, p{n) = tb for every n G A\ {«/,}, and I5{n) = Q for every nGN. That is, initially all machines 
are positioned at the source node of the graph and are in their initial state, and all registers are 0 . 

The successor relation —F x F A defined as —)•= where for each i G {1,... ,m} it holds 

that {{G, p, p), {G', p', 15')) G^i, (denoted {G,p,l5) -G-i {G',p',ff)) iff the following hold: 

• G' = G, where G = {N,E,nb,ne) G is a graph generated by 

• There exist an edge e = (n,n', (off)) G E, states q,q' G Q, and a value b' gM such that: 

(i) (i,q) G p{n) (Note: n 7 ^ n', since ^ is an SPGG), 

(ii) {q,a{e),p{n),q',b')G5, 

(Hi) p'{n) = p{n)\{{i,q)}, p'{n') = p(n)\J {{i,q')} and p'{n") = p(n") for all n" GN\{n,n'}, 
(iv) P'{n) = y and P'{n") = ^{n")for all n" G N\{n}. 

Vfe say that the edge e is compatible with the transition 7 —)• /. 

A run p of T(j(f,m.,^) = (F,Fo,—)•) is a sequence of configurations p = 70 ... 7 / G F* such that 
7 () G Fo and 7 _i -)■ 7 for each /=!,...,/. 

Intuitively, the infinite-state transition system captures the behaviors of m machines, 

copies of .Jf, on the family of all series-parallel graphs derived by f#. 

2.3 Configuration properties and verification problem 

A configuration property describes a set of configurations. Let n be a variable (ranging over nodes), 
and S G M( 2 ). The set of configuration properties consists of the positive Boolean combinations (no 
negation) of atomic properties of the form 3n. S < p{n). 

A configuration 7 = {G,p,p) G F with G = (N,E,nb,ne) satisfies an atomic configurafion prop- 
erfy (p = 3n. S A p{n) (wriffen J \= (p) iff fhere exisfs a node nGN such fhaf Sfi[qGQ \ (i,q) G 
p{n), where / G {1,... ,m}], fhaf is, fhe mulfisef S is confained in fhe mulfisef of machine sfafes in fhe 
node n in fhe configurafion 7 . The relation |= is nafurally extended fo posifive Boolean combinations. 
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Let {^,m) be a system of machines and ^ an SPGG. Given a configuration property F describing a 
set of final configurations, the verification problem Reach(^,m,f^,F) is to decide whether there exists 
a run p = 70 ... 7 /^ of T {^such that Yi\=F for some 0 < / < /, i.e., a run that reaches F . 

Since our model allows machines to do arbitrarily many “reversals” (i.e., following forward and 
backward edges) and do not fix a bound on fhe number of shared regisfers fhaf are read or wriffen, if 
easily capfures linear bounded aufomafa. Thus, fhe verificalion problem is in general undecidable. 

Proposition 1. The verification problem is undecidable. 

2.4 Bounded verification problem 

Since fhe general problem is undecidable, we focus on a bounded version. We infroduce fwo resfricfions. 
Firsf, we allow each machine fo make only a bounded number of reversals (a reversal occurs when fhe 
machine changes direction in fhe graph). Second, we fix an a priori bound on fhe number of shared 
regisfers. Thaf is, while fhe SPGG generafes a pofenfially unbounded sef of graphs, wifh unboundedly 
many nodes, we assume fhaf fhere is some fixed bound k on fhe number of Boolean regisfers locafed af 
nodes of a generafed graph (fhese k regisfers may be sifuafed af arbifrary nodes of fhe graph fhough). 

Fix a machine = {Q,q^,'L,5), fhe sysfem of machines {.y£',m), and an SPGG(^ = {V,L,R,Go). 

Reversal bound. Lef us fix a run p = 70 ,..., 7 / where 7 = Consider fhe projection of 

p fo —for each machine j € {1,... ,m}. The number of reversals made by machine j along fhe run, 
infuifively, is fhe number of fimes if changes from fraversing an edge marked wifh direcfion 1 fo fraversing 
an edge marked wifh direcfion — 1 , or vice versa. 

Formally, lef e\e 2 .. .e„ be a sequence of edges. A reversal occurs af position i if a{ei) = (•, 1) and 
a(G+i) = (■,-!) or if a(ei) = (■,-!) and a(e,-+i) = (■,!). 

Now, lef 7 j -^j 7 i+i, 7-2 —5-y 72+b ... be fhe fransifions of machine j along fhe run p, and lef e;,, e, 2 ’ 
... be fhe compafible edges fhaf were faken by machine j. The number of reversals of machine j along 
p is fhe number of reversals in fhe sequence e,,e, 2 .... 

For r > 0, fhe sef of r-reversal bounded runs of T {.JT, m, ) is fhe sef of runs in which each machine 
makes af mosf r reversals. 

Register bound. The register bound fixes a number k of Boolean registers. That is, each graph G 
derived by W comes with a mapping fc : A { 0 , 1 }, such that |fc^^(l)| < k, and we allow the machines 
to read and write register values only when their current node is in K'~^(l). 

To derive graphs with a mapping k, we modify an SPGG to “mark” some nodes along the derivation, 
and ensure that any derived graph has at most k marked nodes. (The formal details are similar to con¬ 
structing a CFG for a CFL with at most k marked positions from a CFG for the (unmarked) language.) 
For an SPGG we denote by the SPGG that marks at most k nodes of a derived graph. We write, 
by abuse of notation, (G, x) € for a graph G which is the symmetric closure of a graph derived 

by together with the mapping K. 

In addition, we modify the successor relation of the graph-grammar transition systems T{.JT 
to require (ii)’ {q,a{e),^{n),cfi,b') E 5 if K{n) = 1 and {q,a{e),f),q',0) E 8 otherwise. 

Example 3. The SPGG fS shown in Example\I}can be modified into an SPGG that derives graphs in 
which at most 2 nodes are marked. Furthermore, we can consider SPGGs that not only ensure an upper 
bound on the number of marked nodes, but impose constraints on their location. For example, we can 
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consider an SPGG that additionally requires that by applying the rule (vq, • Vj) the corresponding 
intermediate node between the edges labeled Vc and vj is marked to contain a register. 

If we then consider the graph-grammar transition system T where .Jf is the finite-state 

machine described in Example^ and let G be the graph depicted in FisureUal then there does not exist 
a run with underlying graph G that reaches a configuration satisfying (p = 3 n. [qa,qa\ ^ P{n), since the 
register at node n\ acts as a semaphore that does not allow two copies of the machine .M to enter the 
part of the graph containing edges labeled with the letter a. 

The reversal-bounded and register-bounded verification problem takes as input a system of machines 
{.jf,m), an SPGG and parameters r and k, and a configuration property F, and asks if there exists an 
r-reversal bounded run of the machines on some graph derived by that reaches F. 

Our main result is the following. 

Theorem 1 , The reversal- and register-bounded verification problem is decidable. 

Remark. Our decidability results hold for a somewhat more general model, in which the machines can 
read one of the fixed number of registers not at its current node but can only write to the register at its 
current node, or vice versa. We work in the simpler setting to keep the notation manageable. 

3 Properties of Reversal-Bounded Runs 

Fix a machine ^ the system of machines {.jf,m), an SPGG ^ = {V,L,R,Go) and the 

parameters r and k. In this section we state two properties of r-reversal bounded runs of T {.Jf 
that allow us to encode such runs as words over a finite alphabet and to reduce the reversal- and register- 
bounded verification problem to the emptiness test for a context free language. 

Given a run p = 70... 7/- and a machine m}, an i-block is a segment p [71,72] = 771 • • • Jp 

of the run p such that 7, 77+1 for each j\ < 7 < 72- That is, all transitions in the part p[7i,72] of the 

run are made by machine i. The following proposition establishes that for every r-reversal bounded run 
p we can reorder its transitions to obtain an r-reversal bounded run p such that the number of maximal 
blocks in p is not greater than a constant depending on m,r and k (and not on the length of the run p). 

Proposition 2 . For every r-reversal bounded run p = 70,..., 77 ofT{./^,m,^^) there exist an r-reversal 
bounded run p = %,... ,Yf of T and a sequence of indices 0 = /o < /i < ■■ ■ < fu = f such 

that the following conditions are satisfied: 

• u < (^r-m-fk-m-(r-fl)-{-I'j ■ (m-fl), 

• for each i £ {0 ,there exists m, £ {1,... ,ni} such that p[fi,fi+\\ is a mi-block, 

• 7 o = 7 o and p/ = p/, where 7 f = (G,p/,j8/) and 77 = (G,p/,j8/). 

Remark. In the proof of the above proposition we construct the run p by reordering transitions in p while 
keeping in place the transitions that access registers. Thus, the relative order of transitions which modify 
registers is preserved, which in turn implies that 77 = 77 (that is, we have also = jSj). 

The second property uses the bound r on the number of reversals of each machine in an r-reversal 
bounded run p to relate p to the set of paths in the underlying graph traversed by the machines in p. 

A trace r is an element of the set Z*. A trace T = ai... a/ is compatible with a run p = 70,..., 77 if 
there exists a sequence of edges e\e2.. - ey compatible with p such that a{ei) = (a,-, •) for every 0 < / < /. 

Given a graph G = {N,E,nh,ne) £ J^"(^*) and a trace T we define Paths(G,T) to be the (possibly 
empty) set of paths from n/, to ng whose sequence of edge labels is T = ai... Gy. Formally, for a sequence 
of nodes 7 t = noni.. .ny ^ N* we have 7 t £ Paths(G, t) iff no = ni,, ny = Ug and («;_!,n,, (cJ,, 1 )) £ E. 
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Below we establish a property of an r-reversal bounded run p = 70 ... 7 /^ of and a trace 

T that is compatible with p. Namely, for each machine / G {1,... ,m} the corresponding subsequence T, 
of T can be split into at most r + 1 segments, such that each of those segments can be embedded in a trace 
labelling a simple path from nt, to or from to This is formalized in the following proposition, 
which easily follows from the properties of series-parallel graphs. 

Proposition 3. Let p be an r-reversal bounded run ofT{^,m,^^) and X be a trace that is compatible 
with p. Let Ki be the sequence of nodes visited in p by machine /€{!,... ,ni}, in the order they occur in 
p, let T, be the corresponding subsequence of X, and ri <r be the number of reversals of machine i in p. 

Then, for each i G {I,... ,m} and each h G {I,... ,r + \ } there exist traces Xi^h, 'f/ h, tmd 

sequences of nodes 71,- G N* such that the following conditions are satisfied: 

• Ki^h e Paths(G, T,-ft), and Xjj, = x'j^ ■ x'/,^ ■ x'% and Ki^h = K,h ' Kh ' 

• For each i G {1, •.. ,m} there exist indices 0 = 70 < j\ < ... < 7V,+i = |^i| ~ 1 such that: 

- ifl<h<ri + \ and h is odd, then Xi[jh-\ + Ijift] = "f/ft <^nd Ttfjh-x^jh] = ^fft/ 

- ifl<h<ri + l and h is even, then Xi[jh-i + IJh] = ^i[jh-i,jh] = 

Proposition |2] allows us to restrict our reasoning to r-reversal bounded runs with at most {r-m + k- 
m-{r+\) + \) -{m+l) blocks. Proposition [3] allows us to reduce from reasoning about graphs derived 
by to reasoning about r+ 1-tuples of traces in such graphs. Based on these results, we define the two 
parameters p= {r-m + k-m -{r+\)+ \) ■ {m+\) and t = r-m, where r = r -|- 1 . 

4 Automata-theoretic Algorithm 

In this section we present an automata-theoretic algorithm for solving the reversal- and register-bounded 
verification problem. Before we give an overview of our algorithm and outline the automata constructions 
it comprises, we recall some basic definitions from automata theory. 

4.1 Preliminaries 

A 2-way nondeterministic finite automaton (2NFA) is a tuple sF = {Q,q^,L,5,A), where 2 is a finite 
set of states, q^ G Q is the initial state, £ is a finite alphabet, 5 CgxrxQxj—l,l}is the transition 
relation and A C g is a set of accepting states. £/ is deterministic iff 5 is a function from 2 x £ to 
Q X {—1,1}. i?/ is a 1-way NFA (NFA) iff r/ = 1 for each {q,o,q',d) G 6. 

For q,q' G Q, w',w",w''',w"" G £*, a G £ and o' G £U {e}, let {q,w',0,w") {q',w'",o',w"”) 

iff {q, o,q',d) G 5 and (1) if d = l, then w'" = w' . 0 , w" = o' .w"", either o' gL or o' = e and w"" = £ 
and (2) if <i = —1, then w"" = o.w", w' = w'". 0 ', either a' G £ or a' = £ and w'" = e. 

If £/ is an NFA, we define 5{q,w) for w G £* in fhe obvious way. 

Lef hG £ and HG £, where be designafed symbols and wG (£\{I-,H})*. 

If stf is a2NFA,fhen w G.^{£/) iff (^°,£,l-,w H) {q,'r w -\,e,£) or {q^,e,w -\) (^,£,£,F 

w H) for some q G A. If is an NFA, fhen w G iff 5 ( 17 °, F w H) FlA 7 ^ 0. 

A push-down automaton (PDA) is a fuple = ( 2 ,( 7 *^,£, A, _L, 5), where 2 is a finite sef of sfafes, 
< 7 *’ G 2 is the initial state, £ is a finite input alphabet, A is a finite stack alphabet, X is the start symbol 
and 5 C 2 X (£U {£}) x A x 2 x A* is the transition relation. For q,q' G Q, o G £U {£}, w G £*, a G A, 
a,l5 G A* we define {q, o.w,a.a) {q',w,p.a) iff {q, 0 ,a,q',p) G 5. 

For a PDA ^^,w G Xf(,^) iff (^°,F w H,X) (^,£,±). 
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4.2 Overview of the algorithm 

We now outline the construction of a PDA £/, which we use in order to reduce the reversal- and register- 
bounded verification problem to checking emptiness of a PDA. We begin by describing the input of the 
automata involved in the construction and then proceed to give an overview of the construction followed 
by a formal definition of the input alphabets of these automata. 

The automaton ^ reads words that consist of traces in £*. In order to reflect sufficient information 
about the corresponding nodes and registers in the underlying graph, these traces are annotated as fol¬ 
lows. First, since graphs derived by contain at most k registers, we assume these registers to have 
unique identifiers from the set {1,... ,k}. Thus, a triple {o,j\,j 2 ) G T x {0,... ,fc} x {0,... ,^} consists 
of an edge label a and the identifiers of the registers at the source and target node of the edge, where 0 in¬ 
dicates no register at the respective node. We add additional annotation to reflect which nodes are shared 
in the corresponding paths, that is, positions where paths in the series-parallel graph branch off or join. 

The automaton £/ reads such annotated traces and checks the existence of a run by emulating the be¬ 
haviour of the machines on these traces by guessing an execution for each of them. An execution of ^ = 
(2,< 7 °,1,5) is asequence ^ = qQ,{Oi,b\,b\),qi,... ,{Of,bf,b'^),qf such that {qi^i,Oi,bi,qi,di,b'i) G 5 
for some di G {1,-1}. In addition to verifying that each guess is indeed an execution, needs to also 
check that the values written to and read from the shared registers by different machines are consistent. 

Formally, an annotated trace and executions of the machines define a read-write sequence rj = 
(ji,bi,b \),..., {jf,bf,b'j) G ({0,... ,k} X B X B)*, where, intuitively, ji is the location that is read and/or 
written. Such a read-write sequence rj is valid w.r.t. an initial register valuation jSq : {1, • • • ,k} —> B iff 
each read operation reads the value written by the most recent write operation, or the initial value from 
jSo if it is not overwritten, that is, for / G {1,...,/} with y, > 0 it holds that if there is i' < i such that 
ji' = ji-: then bi = b'-, for the largest such i', and otherwise bi = j8o(y,). 

Thus, the automaton accepts tuples of traces in some graph derived by annotated with infor¬ 
mation about registers and about nodes shared by the corresponding paths in the graph, also guesses 
an execution for each of the ni machines. The PDA £/ is constructed as the intersection of a PDA 
and an NFA (Section 14.31) . checks that its input word encodes a tuple of traces in some graph 
derived by and that these are correctly annotated with information about registers and the nodes that 
are shared among the paths corresponding to these traces. The NFA ij/g guesses and verifies the exe¬ 
cutions of the machines. It is obtained as the intersection of m -|- 2 NFAs: m NFAs A,, one for each 
/ G {I,... ,nr}, an NFA jz/g and an NFA The NFA verifies that the guess of an execution of ma¬ 
chine / G {I,... ,m} is correct. We describe the construction of as a 2NFA (Section l4~4l) which is then 
converted to an NFA using standard techniques il^ . Automaton checks the validity of the read-write 
sequence corresponding to the annotated traces and the guessed executions (Section 1431) . Automaton 
(Section l4~6l) checks that a configuration in F is reached. The reversal- and register-bounded verification 
problem thus reduces to checking emptiness of the language of the constructed automaton . 

According to Section[3l it suffices to reason about t = m- {r-\-\) traces in graphs derived by To 

this end, we define the trace alphabet Bt = U {b}) x {0,... x {1,... U {1,... . Words 

over Zt are tuples of t traces in some graph G, annotated with additional information. Each letter in Zt 
contains one row for each of the m machines and each of the r = r-\-\ paths corresponding to it. There are 
two types of letters. Each row in a letter of the first type consists of a letter in Z (or the special symbol b) 
together with two register identifiers in {0,... ,k} and a path index in {1,... ,f}. The letters of the second 
type are t-tuples of path indices in {1,... ,f}, where equal indices indicate paths sharing a node. 

The execution alphabet Zg = ({0,... ,p} xBxBxQxjl,... ,(})^ is used to describe tuples of 
executions, one for each of the m machines. Each letter contains r = r -|- 1 rows for each machine, one 
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for each of its paths. Each row in the letter consists of a block number in {0,... ,p}, two register values 
(one for the read and one for the write operations), a successor state and an index of a row in an associated 
trace word (word in Zt). Let £ = Zt x Ze be the product of the trace and execution alphabets. 

In what follows, if T = ai... a/ G ZJ, then Oj = {oij ,..., Gtj) denotes the elements of the 7-th letter 
of the word T for 7 G { 1 ,...,/}, and we use T,- = a, 1... Gij to denote the /-th row of T for / G { 1 ,... ,t}. 
Similarly, if ? = ai... 5 / G Z*, the 7-th letter is Gj = {Gij, Gtj, rjijj,rj^j,■ •, Vmjj), 
for 7 G { 1 ,...,/}, and the /-th row is T,- = a,,i... Gij, for i G { 1 ,...,/}. For n G {l,...,m},/iG { 1 ,...,?} 
and 7 G { 1 ,...,/}, the corresponding letter from Zg is denoted rjn^hj = 

In the remainder of this section we present the intuition behind the automata constructions and their 
properties. 


4.3 PDA accepting traces in a graph 

The PDA is the intersection of a PDA obtained from where ^ = {y,'L,R,GQ) is an SPGG, 
and a NFA that checks that register identifiers are correctly placed. 

The construction of = (2p,^°,Zt U {h, H},Zt U {h, H} U P U {±}, _L, 8p) resembles the classical 
construction of a PDA given a CFG. Here, instead of words generated by a CFG the language 
of consists of t-tuples of (annotated) traces in some graph generated by the grammar. The automaton 
has a stack alphabet ZtU{l-,H}LJP U{_L}, where V consists of symbols corresponding to the variables 
in . The transitions in Sp can be grouped according to the top symbol on the stack: empty stack, top 
symbol G GZtU{l-,H}, and top symbol v G P. Transitions for v G P correspond to the production rules 
of the SPGG For the series composition Sp employs the additional symbol b to allow for traces that 
are aligned in a way that letters in {1,... ,t}' reflect the information about nodes shared by the respective 
paths. For the parallel composition 5p guesses symbols, in the graphs generated by which the corre¬ 
sponding traces occur, together with the number of traces in the subgraph generated by each symbol. 
The number of times a new branch is introduced is bounded by t, the number of parallel traces. 

does not check that the register identifiers in the annotation are consistent among letters corre¬ 
sponding to edges in the graph that share a node, i.e., that letters corresponding to these edges have the 
same identifier for this node. This is done by the NFA = {Qr,q^,'Lt LJ {h, H}, dr,Fr), which also veri¬ 
fies that identifiers for different nodes are unique. To this end, each state q of contains a path index lu G 
{1,... ,t} and a register identifier //, G {0,... ,k} for each row % of T. 8^ checks that the letters in T that 
correspond to edges incident with the same node agree on the corresponding register identifier. The path 
indices 4 in q are used to identify branching or joining paths and the register identifiers //, to check the 
required equalities. In the accepting states the equalities for the sink node of the graph must be satisfied. 
Additionally, 8^ verifies that the register identifiers in r corresponding to different nodes are different. 

The PDA has The construction of and ensures that if 

T G then there exists {G,k) G and for each i G there exists a sequence of 

nodes TT,- in G such that for each row T,- of T there exists a subsequence tt,- G Paths(G, T,) of tt, correspond¬ 
ing to the projection T, = (^|i:x{o,...,t:}2x{i,...,?}) k of Furthermore, these paths can be chosen such 

that edges corresponding to rows with the same path index connect the same pair of nodes. Additionally, 
the mapping k for the nodes on these paths agrees with the corresponding register identifiers in T. 

Conversely, if (G, fc) G and for every n G {1,... ,m} and /i G {1,...,?} we are given a path 

Kn,h G Paths(G, T„,/i) for some trace G Z*, then there exists a word T G which corresponds 

to these paths and traces. The word T is obtained by ordering, extending and annotating the given traces. 
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4.4 2NFA accepting executions 

We construct a 2NFA for each n £ {1,... ,m} that checks that the sequence described by the rows of 
the word that correspond to n is indeed an execution of that reads the corresponding rows of the trace 
word. Furthermore, £/n verifies that the machine switches between traces described by different rows of 
the trace word only at positions at which the traces share a node in the corresponding paths. 

Each state q of £/n = {Qm 2°)^ U {h, H}, 5n,Qn) contains a state q £ Q of .M, which is the current 
state of the simulated machine, and an index / G {1,..., t} in the trace-word that is part of the input word. 

refers to the transition relation 5 of to check the existence of a transition of .M that performs the 
read and write operations determined by the read letter of T. The state q is updated according to d and 
remains unchanged when the machine is inactive in the current part of the trace. The row of the trace 
word that is read in state q is determined by i. The index i can be changed by only if for the current 
letter we have Gt„k £ {1 > • • • T} /j > 0, and for the new value f it must hold that a/ = a,-. That is, the 

machine can switch between traces only at positions where the paths intersect. An additional component 
of q is used to check that block number 0 in t is used to correctly encode the reversals of the machine 
(which do not have to be at the start or sink nodes of the graph). All states are accepting. 

Then, T G ..Sf ( ) iff by taking the elements of ? corresponding to machine n in the appropriate order 

we can construct an execution i§„, formally defined as follows. For each /i G {1,...,?} and Z G {1,...,/}, 
if G I X X {0,...,k}2 and pn^i > 0, fhen, if h is odd, fhen \n,h,i = 

{o,bn,h,hK,h,d ■and if h is even, fhen \n,h,i = q'n^i' Ofherwise, ln,h,i = £■ Then 

ln.h = ln,h,i ■■■■■ ln,h,f if ^ i^ odd, and = ln,h,f ■■■■■ ln,h,i ofherwise. Finally, ^n = q^- \n,i ■ ■■■■ \ny 


4.5 2NFA accepting valid read-write sequences 

Here we describe a 2NFA fhaf checks fhaf fhe executions of fhe differenl machines described by 
fhe inpuf word are compafible wifh each ofher. Thai, is fhaf fhe read and wrile operations of differenl 
machines malch when executed in fhe order determined by fhe inpul word, where each operation is 
labelled wifh a block number, verifies fhaf each block number is used in a single execution and fhaf 
for each execulion fhe sequence of posilive block numbers is nondecreasing. To check fhe validity of fhe 
corresponding read-wrife sequence w.r.l. fhe inilial register values, fracks fhe regisler values al fhe 
end and al fhe beginning of each block and compares fhe values af fhe beginning of block i +1 wifh Ihose 
af fhe end of block i. An assumption is a parlial function A : {1,... ,p} —> fhaf maps a block number 
lo a valuation of fhe regislers, represenling fhe obligation lo verify fhaf al Ihe beginning of a block Ihe 
registers have Ihe respective values. Similarly, a guarantee is a function G : {1,... ,p} — > B^ used lo 
propagate Ihe guarantee lhal al Ihe end of a block Ihe registers have a cerlain value. 

Each slate of Ihe automaton U conlains a block number and a 

valuation of Ihe registers j 8 „ for machine n, a sel P of already seen block numbers, an assumption A and 
a guarantee G. The Iransilion relation Sc checks lhal all read operations of machine n excepl Ihose al Ihe 
beginning of a block read Ihe value stored in /3„. Al Ihe beginning of a block of machine n, Sc guesses 
a valuation of Ihe registers for read operations and stores Ihem in j(3„. The new block number and Ihe 
guess are added to Ihe sel A. The values of ils write operations are used to update /3„ and, al Ihe end of 
a block Ihe respective guarantee is added to G. Sc discharges assumptions in A for which Ihe respective 
guarantees are in G. In an accepting slate Ihe sel A should be empty and Ihe sel P of all block numbers 
in T should conlain all block numbers smaller or equal Ihe maximal one. 

By conslruclion, in each word T G .^{s^c) each block number is assigned to al mosl one machine 
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and for each machine the sequence of positive block numbers is nondecreasing. All such words T are 
accepted by m/c iff the read-write sequence, constructed by ordering elements of x according to block 
number while preserving the order for each individual machine, is valid w.r.t. the initial register contents. 


4.6 NFA checking configuration properties 


The NFA U {hjHjjSsjFs) checks that in some run in corresponding to the 

input word, a configuration that satisfies fhe given configurafion properfy F = 3n. S < ix{n) is reached. 

Since fhe configurafion properfy F asserfs fhe exisfence of a node in fhe graph of a configurafion, 
pofenfial such configurafions can be defecfed by inspecting (af mosf) fwo consecufive letters in fhe word. 
The informalion relevanf for fhe satisfaction of a configuration properfy consisfs of fhe block number and 
successor slate componenls of fhe letters of fhe execulion word and fhe letters of fhe frace word. Thus, 
we define fhe sel C = {1,... ,pY x (QU {_L})^ x Zt and consider pairs of elemenls of C. 


Leico = (p?i,...,p° 




(jO 


,0 _^o _ 


m,r 

where for n € {1,... ,m} and /i G {1,...= 0, q% = q^, q^j^ = A, = 0^,^^= (b, 1,0,0). 

Lei us consider fwo elemenls of fhe sel C: F = (p^ ^,..., p'^j, q[i,..., q'^~, a) j,..., ~) G C and 

c" = (p" 1,..., p" ~, q '{^,..., ql ~, a"i,..., a" ~) G C. 

We say lhal fhe pair {F,c”) occurs in T = ai... a/ G Z iff Ihere exisls a sequence of consecutive 
letters in x such lhal Ihose of c' and c" lhal are nol equal lo cq and c± malch Ihese letters of x in fhe same 
order. Formally, (c',c") occurs in x iff one of fhe following conditions is satisfied. 

(1) F = CO, and p"^ = p„,/,j, = qn,h,i and (c" malches di). 

(2) c" = c_L, and p'^j^ = pn,h,i, q'n,h = and {F malches Of). 

(3) There exists 1 < / < / sueh that 


^ 1,1 ’ 


rO — /-r-!- — I 


“ p'n.h = Pn,h,i-1’ ^n.h = ^n,h,i-\ and {F niafches a/_i), 

- Pn,h = Pn,h,i’ €,h = ‘ln,h,i ^nd 5";, = (c" mafchcs Oi). 

Consider a configurafion 7 G F of a run p lhal salisfies fhe configuration properfy F. This means 
lhal Ihere exisls an edge e £ E, such lhal some of fhe nodes src{e) and trg{e) makes fhe properly Irue. 
Furlhermore, Ihere exils a sel of machines involved in fhe salisfaclion of fhe properly in 7 . Among Ihese 
machines, we distinguish belween fhe one lhal executed Ihe Iasi Iransilion in p leading lo Ibis configura¬ 
tion and Ihe remaining machines. By Ihe definition of runs of Ihe currenl node and slates 

of Ihese remaining machines should be reached al Ihe end of one of Iheir execution blocks. We define a 
predicate aboul pairs of elemenls of C, sels of machines and corresponding positions in Iheir executions 
(i.e., rows in Ihe respective letter of Ihe execution word). The automaton sFs will use Ihis predicate to 
identify letters of Ihe word lhal may encode configurations satisfying Ihe configuration properly F. 

Lei S G M(2), M C {1,... ,m} and /m - M ^ ,r}. For each n £M, lei /„ = fM{n) and if /„ is 

odd, Ihen p„ = p'^j^, q^ = q'^j^ and a„ = and if /„ is even, Ihen p„ = p"^, q^ = and a„ = a"y^. 
Lei no £M be such lhal for each n G M, il holds lhal p„ < p^. We define pn{F,F',M, fm) = Pn for each 
n £M and nQ{F ,F' ,M,fM) = no- 

The node predicate NodeProperty(5',c', c",M,/m) is Irue iff Ihe conditions listed below hold. 

• S = [qn\n £M] and for each n G M \ {no}, Pn < Pno and p{y^ Y Pn,f„- 

• One of Ihe following requiremenls is satisfied: 

- ol^£ {l,...,t} and ol^ = o^^ for each n£M. 

~ = {(^oFoJoJ'o) G L X {1,... ,t} X {0,.. .,ky and for each n gM Ihere exisl a G Z,y,/ G 

{ 0 ,... ,k} such lhal a,) = {o,kJ,f)- 
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- G {1,..., 1} and a" = a"^ for each n £M. 

~ ^no = G r X {1,... ,1} X {0,.. .,k}^ and for each n gM there exist a G ^,j,f G 

{0,... ,A:} such that a” = 

In order to evaluate the above predicates on positions of the input word T, the NFA ^ stores in its 
state an element c' of C. The current letter of the input word determines an element c" of C, and jj/j 
evaluates the node predicate on the pair (c',c"). In order to verify that some run corresponding to t 
contains a configuration satisfying the configuration property F, must detect all pairs on which the 
predicate NodeProperty holds true, that is, they might encode a final configuralion. For each such pair 
musf verify fhaf some of fhe pairs on which fhe predicafe NodeProperty holds acfually fulfils a global 
condifion on z. Namely, fhaf for all fhe involved machines, fhe currenfly executed block number is fhe 
lasf one. (We can, w.l.o.g. resfricf fo runs where only fhe lasf configuralion can be final.) 

A sfafe q oi confains an elemenf c' of C, a boolean value final G B, and for each machine n if 
confains componenls P„ G and G {0,... ,p}. The sel P„ consisls of fhe already seen block 

numbers for n. If fhe currenl teller defines c G C such fhaf NodeProperty(5',c',holds Irue for 
some M C {1,... ,m} and some funclion /m, then final can be set to 1 if it is 0, and the current block 
number of machine n for each n^M can be stored in in order to verify later that a final configuralion 
is indeed reached (by checking fhaf pn is the maximal block number for n). Based on the currently read 
tetter of z, the transition relation 5^ updates the component c' of the state. The accepting state ql can be 
entered after reading H if final = 1 and if is the maximal block number for machine n for each n. 

The construction of ensures that z G iff there exists a pair (c',c") occurring in z encoding 

a configuration that satisfies fhe given configuralion property F. 

4.7 Correctness of the algorithm 

Let , sFm be an NFA obtained respectively from such that for each i G {1,..., ni}. 

Let be an NFA constructed from such that We then 

construct the NFA by intersecting sFt:_ and sF^ and projecting the result on ^t^ i-C-, 

F£{sFf) = n nL(j24)) |i^- The PDA rF is the intersection of and rFe. 

Theorem 2. 0 iff there exists an r-reversal bounded run p = Jq .. .jf in T ,ni,fF^) such that 

Yi ^ F for some 0 <i < f, i.e., a run that reaches a configuration satisfying F. 


5 Conclusion. 

In this paper we define and sludy a class of concurrenl finife-slale aufomafa fraversing series-parallel 
graphs and communicating through shared finite registers located at the nodes of the graph. We con¬ 
sidered a model in which a fixed number of finite-state machines traverse the nodes of a series-parallel 
graph. The series-parallel graphs are generated by a graph grammar, and as we do not impose an a priori 
bound on the size of the graphs, the resulting system is infinite-state. Since the emptiness problem for 
this model is in general undecidable, we consider a natural restriction by putting bounds on the num¬ 
ber of reversals along the computation and the number of shared registers in the graph. With these two 
restrictions, we show that the emptiness problem is decidable and can be reduced to PDA emptiness. 

As we noted in Section [Z41 our decidability result holds for a more general model of communication 
between the machines, in which either read or write (but not both) operations on registers can be non¬ 
local, that is, access a register that is not at the node where the machine is currently located. Another 
possible extension that we omitted for simplicity concerns the language of configuration properties. 
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While here we consider properties that quantify over individual nodes in the graph, we can, in principle, 
extend the construction described in Section l43l to handle configuration properties asserting the existence 
of edges with certain labels, or a fixed number of adjacenf nodes and edges. 

Inferesfing direcfions for fufure work include esfablishing fhe complexify of fhe bounded emptiness 
problem for our model, as well as sfudying differenl extensions. One possibility is to allow parametriza- 
tion in the number of concurrent machines, another is to consider other classes of context-free GTSs. 
For example, using the techniques from ifT^ one can try to extend our results to a more general class of 
graphs of bounded tree width. 
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